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ABSTRACT 

For the purpose of performing safety analysis and risk 
assessment for a potential off-nominal atmospheric 
reentry resulting in vehicle breakup, a synthesis of 
trajectory propagation coupled with thermal analysis 
and the evaluation of node failure is required to predict 
the sequence of events, the timeline, and the 
progressive demise of spacecraft components. To 
provide this capability, the Simulation for Prediction of 
Entry Article Demise (SPEAD) analysis tool was 
developed. The software and methodology have been 
validated against actual flights, telemetry data, and 
validated software, and safety/risk analyses were 
performed for various programs using SPEAD. This 
report discusses the capabilities, modeling, validation, 
and application of the SPEAD analysis tool. 

1. INTRODUCTION 

In the pre-launch safety analysis of a potential off- 
nominal suborbital/orbital reentry, the response of the 
spacecraft to the environment and the outcome of the 
surviving debris are predicted in order to perform risk 
assessment and contingency planning. Vehicle 
safety/breakup analysis has also found application in 
the area of post-flight reconstruction of an off-nominal 
ascent/entry and in the design for debris disposal 
during a nominal reentry. Work devoted to these 
topics have been ongoing for decades and are well 
documented [1-3]. The objectives of these analyses 
include the determination of the sequence of 
progressive failure in the spacecraft components, the 
timeline of the breakup events, the debris survival, and 
the debris dispersion footprint. The basic functions 
required to perform vehicle breakup and bumup 
analysis consist of trajectory simulation, coupled with 
thermal analysis and influences, and the evaluation of 
component failure. To provide these capabilities 
without employing multiple software programs and 
lengthy analyses, the Simulation for Prediction of 
Entry Article Demise (SPEAD) analysis tool was 
developed, which allows the reentry trajectory with 
vehicle breakup and bumup to be propagated 
seamlessly in a single mn. 

The methodology used with the SPEAD software to 
perform vehicle breakup analysis has a long history of 


development and application since the 1970’s. The 
functions from the legacy software have been 
implemented in SPEAD with additional capabilities for 
a wider application. The SPEAD software and 
methodology have been validated against actual flights, 
telemetry data, validated software, independent 
analyses by other organizations, and manual 
calculations. The SPEAD program has been used to 
perform breakup and bumup analysis for the Stardust’s 
potential off-nominal Earth-return reentry; 
reconstmction of the Soyuz 14S and 15S ballistic 
reentries; the Origins, Spectral Interpretation, Resource 
Identification, Security, Regolith Explorer (OSIRIS- 
REx) potential off-nominal Earth-return reentry; 
suborbital reentry of the Falcon 9 Upper Stage with the 
Dragon capsule from a potential launch failure; and 
Boeing CST-100 service module’s nominal reentry 
debris disposal analysis. 

2. METHODOLOGY FOR PERFORMING 
VEHICLE BREAKUP ANALYSIS 

The methodology for performing vehicle breakup 
analysis began its development in the 1970’s at the Jet 
Propulsion Laboratory (JPL) to assess aerospace 
nuclear safety and environmental impact for space 
missions that used nuclear powered systems. The 
safety analysis addressed potential launch failures 
leading to inadvertent suborbital and orbital reentries 
for risk assessment, which was an imperative step for 
obtaining launch approval. The legacy software, also 
developed at JPL, performed three degrees-of-freedom 
(3 -DOF) breakup analysis 4 and was employed over a 
span of three decades for missions including the Viking 
(1975), Galileo (1989), Ulysses (1990), Cassini (1997), 
Mars Exploration Rover (2003), New Horizons (2006), 
Mars Science Laboratory (2011), and Genesis (2001). 

The SPEAD software program has implemented all the 
functions in the legacy software, as well as new 
capabilities to support missions that do not use nuclear 
powered systems. The notable new capabilities include 
6-DOF trajectory propagation, functions for 
performing bumup analysis, the incorporation of a 
build-in database of material properties, debris 
footprint calculation and plotting on a world map, and 
the automation for updating the vehicle’s mass and 
aerodynamic properties following a component failure. 


The process for performing vehicle breakup analysis is 
summarized in the flowchart in Figure 1. 



Figure 1. Process for Performing Vehicle Breakup 
Analysis 


Given a failure scenario, the vehicle state and 
configuration are assumed known. From the detailed 
drawings and design information of the spacecraft, 
thermal nodes are selected which are typically 
components in which a failure will cause a significant 
alteration in the spacecraft configuration or a change to 
the exposure of other components to aeroheating. The 
thermal nodes are modeled as simple shapes; e.g. 
spheres, cylinders, or slabs. During the simulation, the 
node temperatures are calculated for the assessment of 
node failure, and g-loads are evaluated for structural 
failure when applicable. Following a node failure, the 
vehicle mass and aerodynamic properties may need to 
be updated, and the ablation of the node is simulated. 
Subsequently, the impact conditions of the surviving 


debris are determined, and the debris dispersion 
footprint calculated. 

The 6-DOF analysis provides a notional case which is a 
good representation of the probable reentry with 
breakup. In addition, Monte Carlo and sensitivity 
analyses can be performed to help bound the problem, 
including 3 -DOF simulations where the vehicle flies at 
face-on, side-on, and end-on fixed-orientations, and a 
tumbling case by averaging the end-over-end rotating 
motion. Note that all predictions of the vehicle 
breakup and impact conditions are valid only within 
the assumptions and engineering judgment made in the 
analysis. 

3. MODELING AND CAPABILITIES 

The SPEAD analysis tool is a synthesis of a 6-DOF 
trajectory propagator for the simulation of translational 
and rotational motion, with embedded heat transfer and 
structural models for the calculation of thermal and 
mechanical loads to evaluate spacecraft component 
failure. The modeling and capabilities of the software 
program are discussed in the following sections. 

3.1 Trajectory Propagation 

SPEAD is applicable for both Earth and Mars, with the 
option for 3- or 6-DOF trajectory propagation. The 
trajectory is propagated by integrating the coupled 
differential equations for the spacecraft translational 
and rotational motion using fourth-order Runge-Kutta. 
The dynamics consist of gravitation and aerodynamics 
from the environment, as well as thrust and control 
forces from actuation. The common g-load is 
calculated based on the non-gravitational, perturbing 
acceleration. 

Static atmospheres are used in SPEAD where the 
atmospheric density, pressure, and temperature versus 
altitude profiles are provided in tables. Default planet- 
dependent atmospheres are available, with the option 
for user-supplied tables. Exponential interpolation is 
performed for the density, while the interpolations for 
the temperature and pressure are linear. The 
aerodynamics data are also supplied in tables, for linear 
interpolation of up to four independent variables. The 
synthetic wind profile is supplied in a table for linear 
interpolation. The effects of local winds produce both 
downrange and crossrange variations in the prediction 
of impact point and contribute to the aerodynamics 
calculations. The gravitation model can include up to 
twenty zonal harmonic coefficients. 

The modeling of a single motor is available and can be 
adapted to multiple motors. Correction for the ambient 
pressure is made for the vacuum thrust. The time rate 
of change in the vehicle mass could be from propellant 














consumption and/or node ablation, and is one of the 
governing equations propagated by the integrator. 
Note that the separation of a component from the 
spacecraft due to node failure is modeled as an 
instantaneous change in the vehicle mass. A separated 
component flies independently and is assumed to 
tumble randomly. Since the aeroheating on the 
separated node flying alone is no longer dependent on 
body orientation, the software automatically reverts to 
3 -DOF simulation for the separated node. Thus, the 
software generates multiple trajectories in a single run: 
6-DOF for the main vehicle and 3 -DOF for all the 
separated nodes. 

The footprint for the nominal impact points of the 
surviving debris in the notional case is calculated and 
plotted on a world map. An example is given in Figure 
2. To generate the footprint for bounding a piece of 
debris’ impact points due to uncertainties in the 
environment, vehicle properties, and winds, a Monte 
Carlo analysis can be performed where the dispersions 
are modeled with normal or uniform distributions. A 
scheduler is available to set up user-defined events. 
Through the scheduler, the user can specify and 
automate the change in the vehicle configuration 
following a node failure. Given the new vehicle 
configuration, the software will then update the vehicle 
mass and aerodynamic properties. The software 
architecture consists of modularized functions designed 
to allow quick incorporation of guidance, navigation, 
control, aerodynamics, and mechanical models. 



Figure 2. Footprint Plot on World Map 


3.2 Thermal Models 

The thermal node temperature is calculated by 
modeling the applicable convective, radiative, and 
conductive heat transfer. The free-molecular and 
continuum convective heating are calculated, and the 
transition is assumed to occur approximately where the 
two curves intersect. Thus, the lower value of the free- 
molecular and continuum heating is used for the 


reference convective heating. In a 6-DOF simulation, 
the local convective heating on a node is dependent on 
1) the location of the node in the spacecraft and its 
orientation to the flow modeled by an exposure factor, 
and 2) the geometries of the spacecraft and the node 
modeled by a heating factor and convective area. The 
exposure factor ranges from zero to one; zero for 
complete shielding from the flow and one for direct 
exposure to the flow. The aerodynamic radiative 
heating is considered only for reentries at high speeds; 
e.g. greater than 9 km/s in the Earth atmosphere. The 
black-body radiative cooling is determined by the 
Stefan-Boltzman law. One-dimensional conductive 
heat transfer between adjacent nodes is approximated 
based on the Fourier’s law of heat conduction. 

Once a node reaches its melting temperature, node 
ablation is initiated. The node ablation simulates the 
decreasing mass; the decreasing convective, radiative, 
and reference areas; and variable heating factor. 
Analyses have shown that the simulation of the 
decreasing mass and areas can affect the ablation of the 
node significantly. Without considering the decreasing 
mass and areas, the node will go through more 
ablation, resulting in fewer surviving debris. Towards 
the end of the heat pulse during the reentry, the 
radiative cooling begins to exceed the convective 
heating and could leave a node only partially ablated. 
In general, the effect of radiative cooling on node 
temperature is not negligible. During the simulation, a 
thermal node is in one of three phases: heating, 

melting, or cooling phase. Without the modeling of 
radiative cooling, the thermal node would have only 
the heating and melting phases. 

A built-in database provides the thermo-mechanical 
properties of common spacecraft materials and 
propellants. For solids, the material properties include 
the density, specific heat, thermal conductivity, 
emissivity, melting temperature, and heat of fusion. 
For materials that tanks are commonly constructed of, 
the percent of room temperature yield strength versus 
temperature are also provided in the database. For 
liquid propellants, the properties include the enthalpy 
of vaporization, density of saturated vapor, surface 
tension of liquid-vapor, density of saturated liquid, 
specific heat at constant volume, and the coefficients 
for the vapor pressure equation. Currently, there are 
over fifty material types and less than ten propellants in 
the database. Typically, the specific heat, emissivity, 
and thermal conductivity are modeled as constants in 
the analysis, but an option exists for modeling these 
properties as a function of node temperature from the 
database. The software also provides an option for the 
user to specify additional materials and properties not 
found in the database. 


Altitude vs. Time 


3.3 Node Failure Evaluation 

Node failure is typically evaluated based on the 
material melting temperature. However, the g-load and 
the differential pressure are also considered if the 
failure criteria were provided by the project. The 
differential pressure is the differential force along the 
direction of deceleration applied on a support 
connecting two components of different masses. An 
option exists in SPEAD to evaluate the failure of a 
pyrotechnic by specifying the auto-ignition 

temperature. This feature is rarely used since the 

pyrotechnic is usually buried in the spacecraft and 
shielded from aeroheating, and therefore not selected 
as a thermal node. 

Three different modes of failure are evaluated for a 
liquid propellant tank. First, the tank could fail by 
reaching the melting temperature. The liquid 
propellant in a propellant tank acts as a heat sink and is 
considered in the calculation of tank temperature. The 
second mode of failure is to bum through when the 
burnout flux is exceeded. The convective heat flux 
applied to the tank is transferred to the liquid propellant 
by nucleate boiling. As the external heat flux rises and 
the nucleate boiling limit is exceeded, the liquid can no 
longer serve as a heat sink in transition boiling. Thus, 
heating is absorbed by the tank wall, and subsequently 
tank failure can occur in the film-boiling region due to 
stagnation point flux on a sphere or stagnation line flux 
on a cylinder. The third mode of failure for a tank is to 
mpture from excessive internal pressure. This occurs 
when the total internal pressure from the liquid vapor 
pressure of the liquid propellant and the pressure of the 
gas exceeds the tank burst pressure. The pressure of 
the gas is a function of the current tank temperature, 
the operating temperature, and the operating pressure. 
Once the tank failure occurs, the liquid propellant is 
assumed to escape. The chemical reaction of the liquid 
propellants is not modeled in SPEAD. 

4. SOFTWARE VALIDATION 

The 3 -DOF trajectory propagation in SPEAD was 
validated against the Simulation and Optimization of 
Rocket Trajectories (SORT) program, which is a 3- 
DOF legacy software at the NASA Johnson Space 
Center. The co-plots of the altitude, relative velocity, 
relative flightpath angle, and ground track are given in 
Figure 3 - Figure 6. The 3 -DOF trajectory propagation 
and g-load calculation in SPEAD were also validated 
against the AeroCAPture Simulation (ACAPS) 
software, which was validated against the Pathfinder 
Mars entry and Stardust Earth return post-flight 
reconstmctions, and against the ATRAJ2 software tool. 



Figure 3. Altitude Co-plot for Validation Against 
SORT 
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Figure 4. Relative Velocity Co-plot for Validation 
Against SORT 


Relative Flight Path Angle vs. Time 




Figure 5. Relative Flightpath Angle Co-plot for 
Validation Against SORT 



Figure 6. Ground Track Co-plot for Validation 
Against SORT 

The 6-DOF trajectory propagation in SPEAD was 
validated against the Jaffe code. It is a 6-DOF legacy 
software developed at JPL for an axi-symmetric body, 
which does not require the calculation of vehicle bank 
angle. The Jaffe code was validated against flight data 
obtained from ballistic range, free-flight range, and 
drop tests. The co-plots of the altitude, total angle-of- 
attack, roll, pitch, and yaw are given in Figure 7 - 
Figure 11. 



Figure 7. Altitude Co-plot for Validation Against the 
Jaffe Code 
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Figure 8. Total Angle-of-Attack Co-plot for Validation 
Against the Jaffe Code 
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Figure 9. Roll Co-plot for Validation Against the Jaffe 
Code 



Figure 10. Pitch Co-plot for Validation Against the 
Jaffe Code 



Figure 11. Yaw Co-plot for Validation Against the 
Jaffe Code 


The node temperature from convective heating 
calculated in SPEAD was validated against the legacy 
software for breakup analysis as shown in Figure 12. 
The calculation of the convective heating and 
convective area over a sphere was validated against 
hypersonic, shock-tube data. The remainder functions 
in the software were verified by manual calculations, 
including the free-molecular convective heating, 
continuum reference convective heating, aerodynamic 
radiative heating, integrated heating, radiative cooling, 
conductive heat transfer between adjacent nodes, and 
node ablation. 


off-nominal Earth-return reentry; the suborbital reentry 
of the Falcon 9 Upper Stage with the Dragon capsule 
from potential launch failure [7]; and the Boeing C ST- 
100 Service Module’s nominal reentry breakup 
analysis. 

Coincidentally, the studies on the Stardust’s off- 
nominal Earth-return and the Soyuz’ ballistic reentries 
are also suitable references for the validation of the 
software and methodology for performing breakup 
analysis. These two cases are discussed in further 
detail in the following sections. Note that previous 
studies to validate the methodology had been 
performed by other analysts but are not discussed in 
this report. 

5.1 Case 1: Stardust Potential Off-Nominal Earth 
Return 

In compliance with the NASA guidelines and 
requirements, independent breakup and burnup 
analyses were performed by Lockheed Martin (LMA) 
and JPL prior to the 2006 Earth-return of Stardust to 
determine, in the event of an off-nominal reentry, if 
any spacecraft component could survive to reach the 
ground, resulting in a higher risk of human casualty. 
Both the bus and the sample return capsule of the 
Stardust spacecraft were analyzed, as illustrated in 
Figure 13. In the JPL analysis, an early version of the 
SPEAD program was used to perform the burnup 
analysis. 



Figure 12. Node Temperature Co-plot for Validation 
Against Legacy Software for Breakup Analysis 


5. VALIDATION AND APPLICATION OF 
METHODOLOGY 

The SPEAD analysis tool was used to provide vehicle 
safety or breakup analysis for various missions. These 
included the Stardust’s probable off-nominal Earth- 
return reentry [5]; the reconstruction of the Soyuz 14S 
and 15S ballistic reentries [6]; OSIRIS-REx’s probable 
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Figure 13. Stardust Spacecraft 

The independent analyses produced mostly the same 
results. For the bus, the two analyses were in 
agreement and showed complete demise of the bus 
components with no surviving debris. For the capsule, 
the analyses determined complete demise of most of 
the capsule components, but differed in the results for 
two components: the nose ballast and the deck ballast. 
LMA showed full demise for the two ballasts, while 
JPL showed survival of the nose ballast with no 
ablation and partial to full demise of the deck ballast. 
The differences in the results for the two ballasts could 
be from differences in the models used. The 
decreasing mass and areas of the node during ablation 
was modeled in the JPL analysis but not in the LMA’s. 



The deck ballast was eventually removed from further 
consideration since the small surviving fragment would 
not exert enough kinetic energy at ground impact to be 
a source of risk to the population or property. 
However, the nose ballast was considered in the risk 
analysis, as well as the heatshield which both LMA and 
JPL determined would survive. 

Although there was close agreement between the two 
analyses in predicting the same outcome for most of 
the spacecraft components, it could not be considered 
as validation. However, the agreement contributed to 
the credibility of the methodology and analysis tool. 

5.2 Case 2: Soyuz 14S and 15S Ballistic Reentries 

The Soyuz 14S reentry in 2007 and the 15S reentry in 
2008 were ballistic due to a failure in the separation 
between the descent module (DM) and the service 
module (nAO) prior to atmospheric entry. The two 
modules eventually separated during the reentry 
following the failure of the modules’ interface from 
aeroheating, and the DM landed safely. 

In the post- flight analysis for trajectory reconstruction, 
the truss in the DM— nAO interface, the hatch antenna, 
and the chute cover were three of the thermal nodes 
modeled for temperature calculation and failure 
evaluation. A notional 6-DOF trajectory was 
generated, providing a time history of events and the 
motion of the spacecraft. The data available for the 
validation of the analysis and models included 
photographs of the DM taken after the landing, 
accounts from the astronauts onboard, and limited 
telemetry data. Note that the telemetry data were 
obtained after the analysis had already been performed 
and presented. Therefore, the models and simulation 
could not be manipulated intentionally to match the 
telemetry data. 

The simulation from the analysis produced a maximum 
g-load and rotational motion for the reentry that were 
consistent with the astronaut’s onboard observation. 
The predicted time and altitude of the truss failure 
leading to the separation of the modules and the 
subsequent tumbling motion of the DM until the 
vehicle trimmed showed a close match with the 
telemetry data. The predicted temperature of the hatch 
antenna which resembled a circular disk indicated that 
it reached the melting temperature during the reentry. 
It was verified by the photographs showing that most 
of the hatch antenna had melted away. The predicted 
temperature of the parachute cover showed that the 
outer surface of the cover got close to its melting 
temperature, but the aluminum frame beneath the cover 
had only a small increase in temperature through 
conductive heat transfer. Photographs of the parachute 


cover verified that the outer surface was charred, but 
the aluminum frame underneath remained pristine. 

The Soyuz analysis resulted in the validation of both 
the software and the methodology. The 6-DOF 
trajectory simulation and thermal models in SPEAD 
were validated, as well as the methodology in 
predicting node temperature and node failure. 

6. CONCLUSIONS 

The SPEAD analysis tool provides a synthesis of 
models for trajectory propagation, thermal analysis, 
and the evaluation of spacecraft component failure to 
perform a complete vehicle breakup and bumup 
analysis in a single run. The methodology to perform 
the breakup analysis predicts the sequence of events, 
the timeline, and the progressive demise of spacecraft 
components. 

The validation of the software and methodology have 
shown favorable comparisons against actual flights, 
telemetry data, validated software, independent 
analyses by other organizations, and manual 
calculations. The SPEAD analysis tool has been used 
to perform breakup and bumup analysis for pre-launch 
risk assessment and contingency planning, post-flight 
trajectory reconstruction, and in the design of debris 
disposal during nominal reentry. Future work includes 
the continuation of the validation of the SPEAD 
software and the methodology, and expanding the 
built-in database of material properties. 
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